# pfSense + haProxy 1 ip, 2 servers

**URL:** <https://discourse.haproxy.org/t/pfsense-haproxy-1-ip-2-servers/5521>\
**Category:** Help!\
**Created:** [July 24, 2020, 2:42am UTC](https://discourse.haproxy.org/t/pfsense-haproxy-1-ip-2-servers/5521 "2020-07-24T02:42:55Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![maxtim](https://avatars.discourse-cdn.com/v4/letter/m/838e76/32.png) [@maxtim](https://discourse.haproxy.org/u/maxtim)\
**Post date:** [July 24, 2020, 2:42am UTC](https://discourse.haproxy.org/t/pfsense-haproxy-1-ip-2-servers/5521/1 "2020-07-24T02:42:55Z")

</div>

Hello,  
The scenario seems pretty simple, but I am having a very difficult time implementing. Briefly:  
WAN → pfSense(haproxy) -1\> x.x.x.249 [example1.com](http://example1.com) → x.x.x.246 [example2.com](http://example2.com)

I have certs on both servers using certbot/letsencrypt. Currently, both sites are returning error 500.  
I’m really not sure how to troubleshoot/where to go from here as I’ve been feverishly searching for about two days now to get this to work.

- pfsense v 2.4.5-RELEASE-p1  
– haproxy v 1.8.25

- Relevant configs:

- stats show:

> pxname,svname,qcur,qmax,scur,smax,slim,stot,bin,bout,dreq,dresp,ereq,econ,eresp,wretr,wredis,status,weight,act,bck,chkfail,chkdown,lastchg,downtime,qlimit,pid,iid,sid,throttle,lbtot,tracked,type,rate,rate\_lim,rate\_max,check\_status,check\_code,check\_duration,hrsp\_1xx,hrsp\_2xx,hrsp\_3xx,hrsp\_4xx,hrsp\_5xx,hrsp\_other,hanafail,req\_rate,req\_rate\_max,req\_tot,cli\_abrt,srv\_abrt,comp\_in,comp\_out,comp\_byp,comp\_rsp,lastsess,last\_chk,last\_agt,qtime,ctime,rtime,ttime,agent\_status,agent\_code,agent\_duration,check\_desc,agent\_desc,check\_rise,check\_fall,check\_health,agent\_rise,agent\_fall,agent\_health,addr,cookie,mode,algo,conn\_rate,conn\_rate\_max,conn\_tot,intercepted,dcon,dses,  
> HAProxyLocalStats,FRONTEND,1,1,2000,2,135,24816,0,0,0,OPEN,1,2,0,0,1,0,1,0,1,0,0,0,0,1,1,2,0,0,0,0,http,1,1,2,2,0,0,  
> HAProxyLocalStats,BACKEND,0,0,0,0,200,0,135,24816,0,0,0,0,0,0,UP,0,0,0,0,221,1,2,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,http,roundrobin,  
> SplitFinleyCorbett,FRONTEND,0,0,2000,0,0,0,0,0,0,OPEN,1,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,http,0,0,0,0,0,0,  
> DebianServer\_ipvANY,DebianServer,0,0,0,0,0,0,0,0,0,0,0,0,UP,1,1,0,0,0,221,0,1,100,101,0,2,0,0,L7OK,200,1,0,0,0,0,0,0,0,0,-1,OK,0,0,0,0,Layer7 check passed,2,3,4,192.168.1.249:443,http,  
> DebianServer\_ipvANY,BACKEND,0,0,0,0,200,0,0,0,0,0,0,0,0,0,UP,1,1,0,0,221,0,1,100,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,-1,0,0,0,0,http,roundrobin,  
> CorbettCloud\_ipvANY,CorbettCloud,0,0,0,0,0,0,0,0,0,0,0,0,DOWN,1,1,0,1,1,221,221,1,102,103,0,2,0,0,L7STS,500,9,0,0,0,0,0,0,0,0,-1,Internal Server Error,0,0,0,0,Layer7 wrong status,2,3,0,192.168.1.246:443,http,  
> CorbettCloud\_ipvANY,BACKEND,0,0,0,0,200,0,0,0,0,0,0,0,0,0,DOWN,0,0,0,1,221,221,1,102,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,-1,0,0,0,0,http,roundrobin,

Server Information:  
both servers are running debian 10 buster, apache 2.4  
[example2.com](http://example2.com) is a nextcloud installation.  
[example1.com](http://example1.com) hosts a handful of random websites and apps that will be split up if I can successfully get haproxy to work.

regardless, both apache sites-enabled configs look similar:

- 000-default.conf

- 000-default-le-ssl.conf

Did I miss anything?

---

<div class="post-metadata">

**Author:** ![maxtim](https://avatars.discourse-cdn.com/v4/letter/m/838e76/32.png) [@maxtim](https://discourse.haproxy.org/u/maxtim)\
**Post date:** [July 25, 2020, 3:50am UTC](https://discourse.haproxy.org/t/pfsense-haproxy-1-ip-2-servers/5521/2 "2020-07-25T03:50:05Z")

</div>

I’ve come to a better understanding about how this all works. I do not want haproxy to handle certs, so I will pass that duty to the backend servers. To do so, I must use TCP. Here is my current configuration:

```
Automaticaly generated, dont edit manually.
Generated on: 2020-07-24 23:14
global
 maxconn 1000
 stats socket /tmp/haproxy.socket level admin expose-fd listeners
 uid 80
 gid 80
 nbproc 1
 nbthread 1
 hard-stop-after 15m
 chroot /tmp/haproxy_chroot
 daemon
 tune.ssl.default-dh-param	2048
 server-state-file /tmp/haproxy_server_state
 ssl-server-verify none

listen HAProxyLocalStats
 bind 127.0.0.1:2200 name localstats
 mode http
 stats enable
 stats refresh 10
 stats admin if TRUE
 stats show-legends
 stats uri /haproxy/haproxy_stats.php?haproxystats=1
 timeout client 5000
 timeout connect 5000
 timeout server 5000

frontend mainTLS
 bind xx.xx.xx.xx:443 name xx.xx.xx.xx:443   
 mode tcp
 log global
 timeout client 30000
 default_backend DebianServer_ipvANY
 frontend http-to-https
 bind xx.xx.xx.xx:80 name xx.xx.xx.xx:80   
 mode http
 log global
 option http-keep-alive
 timeout client 30000
 http-request redirect scheme https 

backend DebianServer_ipvANY
 mode tcp
 id 100
 log global
 timeout connect 30000
 timeout server 30000
 retries 3
 server DebianServer 192.168.1.249:443 id 101 check inter 1000

```

# Notice

However, that there is no other servers besides just the one. How, then, can I route traffic to [example2.com](http://example2.com) based on domain name via TCP without handling certifications on haproxy?

---

<div class="post-metadata">

**Author:** ![maxtim](https://avatars.discourse-cdn.com/v4/letter/m/838e76/32.png) [@maxtim](https://discourse.haproxy.org/u/maxtim)\
**Post date:** [July 26, 2020, 5:27am UTC](https://discourse.haproxy.org/t/pfsense-haproxy-1-ip-2-servers/5521/3 "2020-07-26T05:27:54Z")

</div>

I have gotten things to work using mode tcp rather than http. However, sometimes one site gets a security error when it gets the incorrect cert. Why does one site get the incorrect cert? is haproxy sending a request to the other server first? how is this possible?

```
Automaticaly generated, dont edit manually.
Generated on: 2020-07-25 00:06
global
 maxconn 1000
 stats socket /tmp/haproxy.socket level admin expose-fd listeners
 uid 80
 gid 80
 nbproc 1
 nbthread 1
 hard-stop-after 15m
 chroot /tmp/haproxy_chroot
 daemon
 tune.ssl.default-dh-param	2048
 server-state-file /tmp/haproxy_server_state
 ssl-server-verify none

listen HAProxyLocalStats
 bind 127.0.0.1:2200 name localstats
 mode http
 stats enable
 stats refresh 10
 stats admin if TRUE
 stats show-legends
 stats uri /haproxy/haproxy_stats.php?haproxystats=1
 timeout client 5000
 timeout connect 5000
 timeout server 5000

frontend mainTLS
 bind xx.xx.xx.xx:443 name xx.xx.xx.xx:443   
 mode tcp
 log global
 timeout client 30000
 default_backend DebianServer_ipvANY

frontend http-to-https
 bind xx.xx.xx.xx:80 name xx.xx.xx.xx:80   
 mode http
 log global
 option http-keep-alive
 timeout client 30000
 http-request redirect scheme https 

backend DebianServer_ipvANY
 mode tcp
 id 100
 log global
 timeout connect 30000
 timeout server 30000
 retries 3
 server DebianServer 192.168.1.249:443 id 101 check inter 1000  
 server CorCloud 192.168.1.246:443 id 103 check inter 1000
```

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [July 28, 2020, 10:20pm UTC](https://discourse.haproxy.org/t/pfsense-haproxy-1-ip-2-servers/5521/4 "2020-07-28T22:20:41Z")

</div>

You are just load-balancing between the two servers which is clearly NOT what you want, since those have different applications, right?

You can route based on the SNI value of the client\_hello, but for this to work you need non-overlapping certificates on the backends.

Then put each server in its own backend and instead of default\_backend you use use\_backend based on SNI, like:

```
tcp-request inspect-delay 5s
tcp-request content accept if { req_ssl_hello_type 1 }

use_backend backend1 if { req_ssl_sni -i backend1.example.org }
use_backend backend2 if { req_ssl_sni -i backend2.example.org }

```

Also see:

[https://cbonte.github.io/haproxy-dconv/2.0/configuration.html#7.3.5-req.ssl\_sni](https://cbonte.github.io/haproxy-dconv/2.0/configuration.html#7.3.5-req.ssl_sni)